@flytedesk/app-kit 6.0.0 → 7.1.0

package/dist/auth/client/browserEnvironment.js

@@ -0,0 +1,87 @@
+/**
+ * The real browser behind `./authSession.ts`'s `AuthSessionEnvironment` (AK-35), and the
+ * one per-tab `authSession` every app reads. Browser-safe, ZERO Node imports.
+ *
+ * This package's tsconfig deliberately has no "DOM" lib (it is Node-first — see
+ * `./httpClient.ts`'s own `declare const window`), so the few browser globals used here
+ * are declared below with exactly the members this file touches. The declarations are
+ * erased at compile time and resolve to the real browser objects at runtime.
+ */
+import { createAuthSession, SESSION_CHANNEL, } from "./authSession.js";
+function isSessionMessage(data) {
+    if (typeof data !== "object" || data === null)
+        return false;
+    const { type, userId } = data;
+    return (type === "signed-out" ||
+        (type === "signed-in" && typeof userId === "string"));
+}
+export function browserEnvironment() {
+    return {
+        href: () => window.location.href,
+        navigate: (url) => window.location.assign(url),
+        replaceUrl: (url) => window.history.replaceState(null, "", url),
+        reload: () => window.location.reload(),
+        isVisible: () => document.visibilityState === "visible",
+        onAttention(listener) {
+            const onVisibility = () => {
+                if (document.visibilityState === "visible")
+                    listener();
+            };
+            document.addEventListener("visibilitychange", onVisibility);
+            window.addEventListener("focus", listener);
+            return () => {
+                document.removeEventListener("visibilitychange", onVisibility);
+                window.removeEventListener("focus", listener);
+            };
+        },
+        onRestore(listener) {
+            const onPageShow = (event) => {
+                if (event.persisted)
+                    listener();
+            };
+            window.addEventListener("pageshow", onPageShow);
+            return () => window.removeEventListener("pageshow", onPageShow);
+        },
+        // Read lazily, per call: merely touching `window.sessionStorage` throws when site data
+        // is blocked, which the lifecycle handles per key.
+        sessionStorage: () => window.sessionStorage,
+        localStorage: () => window.localStorage,
+        openChannel(onMessage) {
+            const channel = new BroadcastChannel(SESSION_CHANNEL);
+            channel.onmessage = (event) => {
+                if (isSessionMessage(event.data))
+                    onMessage(event.data);
+            };
+            return {
+                post: (message) => channel.postMessage(message),
+                close: () => channel.close(),
+            };
+        },
+    };
+}
+let instance = null;
+function current() {
+    instance ??= createAuthSession(browserEnvironment());
+    return instance;
+}
+/**
+ * THE session of this tab — one lifecycle, however many components or modules read it.
+ * Created on first use (never at import, so importing this module is safe during SSR or
+ * in a Node test). React code reads it through `useAuthSession()`; anything else (an
+ * API helper, a store outside React) through `authSession.getSnapshot()` and
+ * `authSession.subscribe()`.
+ */
+export const authSession = {
+    getSnapshot: () => current().getSnapshot(),
+    subscribe: (listener) => current().subscribe(listener),
+    signOut: () => current().signOut(),
+    retry: () => current().retry(),
+    refreshUser: () => current().refreshUser(),
+};
+/** Test seam (`@flytedesk/app-kit/auth/client/testing`): stops and forgets the tab's
+ *  lifecycle, so the next use starts a fresh one. */
+export function resetAuthSession() {
+    instance?.stop();
+    instance = null;
+}
+//# sourceMappingURL=browserEnvironment.js.map

package/dist/auth/client/browserEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browserEnvironment.js","sourceRoot":"","sources":["../../../src/auth/client/browserEnvironment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,iBAAiB,EACjB,eAAe,GAKhB,MAAM,kBAAkB,CAAC;AA4B1B,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAA4C,CAAC;IACtE,OAAO,CACL,IAAI,KAAK,YAAY;QACrB,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;QAChC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9C,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QAC/D,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;QACtC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS;QACvD,WAAW,CAAC,QAAQ;YAClB,MAAM,YAAY,GAAG,GAAG,EAAE;gBACxB,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;oBAAE,QAAQ,EAAE,CAAC;YACzD,CAAC,CAAC;YACF,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;YAC5D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC3C,OAAO,GAAG,EAAE;gBACV,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;gBAC/D,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChD,CAAC,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,QAAQ;YAChB,MAAM,UAAU,GAAG,CAAC,KAA8B,EAAE,EAAE;gBACpD,IAAI,KAAK,CAAC,SAAS;oBAAE,QAAQ,EAAE,CAAC;YAClC,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAChD,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClE,CAAC;QACD,uFAAuF;QACvF,mDAAmD;QACnD,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc;QAC3C,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY;QACvC,WAAW,CAAC,SAAS;YACnB,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;YACtD,OAAO,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1D,CAAC,CAAC;YACF,OAAO;gBACL,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;gBAC/C,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;aAC7B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,QAAQ,GAAiC,IAAI,CAAC;AAElD,SAAS,OAAO;IACd,QAAQ,KAAK,iBAAiB,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACrD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAwC;IAC9D,WAAW,EAAE,GAAU,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAS;IACxD,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;IACtD,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE;IAClC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;IAC9B,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC;AAEF;qDACqD;AACrD,MAAM,UAAU,gBAAgB;IAC9B,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC"}

package/dist/auth/client/httpClient.d.ts

@@ -43,8 +43,8 @@ export type AuthUnavailableErrorCode = AuthUnavailableCode | typeof AUTH_UNREACH
  * carrying one of `AUTH_UNAVAILABLE_CODES`) — or the automatic refresh reached no
  * decision at all (`AUTH_UNREACHABLE_CODE`). Transient, and NOT a sign-out: the session
  * (its refresh cookie) is intact and the same request can succeed once the dependency
- * recovers. This client never runs the auth recovery for it; `useAuthSession` keeps the
- * session and retries with backoff (its `"unavailable"` status). A subclass of
+ * recovers. It never announces a session end (`onSessionEnded`); `./authSession.ts` keeps
+ * the session and retries with backoff (its `"unavailable"` status). A subclass of
  * ApiRequestError, so existing `instanceof ApiRequestError` handling still sees it.
  */
 export declare class AuthUnavailableError extends ApiRequestError {
@@ -58,7 +58,7 @@ type AuthUnavailableListener = (error: AuthUnavailableError) => void;
  *  layer learns that an ordinary request hit an outage, so it can show "reconnecting"
  *  instead of treating the user as signed out. Returns the unsubscribe function. */
 export declare function onAuthUnavailable(listener: AuthUnavailableListener): () => void;
-/** A request that missed its deadline (see withDeadline). */
+/** A request that missed its deadline (see withCancellation). */
 export declare class RequestDeadlineError extends Error {
     constructor(what: string, ms: number);
 }
@@ -70,33 +70,31 @@ export declare function getAccessToken(): string | null;
 /** As configured via configureApiClient — same origin/path every request in this
  *  module targets. */
 export declare function getBaseUrl(): string;
-export interface AuthRecovery {
-    /** Runs (or joins) the shared recovery; resolves when it is over, however it ended. */
-    recover(): Promise<void>;
-    /** Whose session this is right now — a stable user id — or null when signed out. */
-    principal(): string | null;
-}
-/** Registers what runs when a request 401s and the automatic refresh-then-retry dance
- *  (below) also fails to recover it — i.e. the session is genuinely gone, not just a
- *  normal access-token expiry a refresh already fixed silently. A consuming app's own
- *  session layer (e.g. one doing a silent OIDC resume, as media-planner's session.ts
- *  does) is the one owner: it decides what "recovered" means and, failing that,
- *  invalidates its session state. Left entirely unset is fine — decodeWithAuthRetry
- *  then just reports the second 401 as a failure, with no recovery attempt. */
-export declare function setAuthRecovery(recovery: AuthRecovery): () => void;
+type SessionEndedListener = () => void;
+/**
+ * Subscribes to the ONE signal that a session is over (AK-35): a request answered 401
+ * and the shared `refreshAccessToken()` then resolved `null` — the plugin itself refused
+ * the refresh cookie. That verdict, and only that, is what `./authSession.ts` turns into
+ * the session-expired state and an automatic sign-in. A 401 that follows a SUCCESSFUL
+ * refresh-and-retry is that route's own answer about that request (the session was just
+ * proven live), so it is thrown to the caller and never announced here — treating it as
+ * a session loss would loop: expired -> sign in -> authenticated -> the same 401.
+ * Internal to `@flytedesk/app-kit/auth/client`: an app never subscribes itself.
+ */
+export declare function onSessionEnded(listener: SessionEndedListener): () => void;
 /**
  * Runs — or joins, when one is already in flight — THE one `POST {routePrefix}/refresh`,
  * and resolves the new access token (also stored via setAccessToken). Single-flighted and
- * always deadline-bound: every caller that 401s, and useAuthSession's own loads, share
+ * always deadline-bound: every caller that 401s, and `./authSession.ts`'s own loads, share
  * this one refresh — the refresh cookie rotates on every call, so two concurrent
  * refreshes presenting one cookie would race, and a refresh that never answered would
  * stall them all.
  *
  * AK-23 (L-c): only the plugin's verdict signs anyone out. A 401 — the one answer the
  * plugin gives a refresh it refuses — resolves `null` ("no new token"), which
- * sendAndDecode treats as the session being gone. Every other outcome rejects with
- * AuthUnavailableError, shared by every waiting caller, so no caller ever runs the auth
- * recovery (the sign-out path) over an outage: the plugin's own 503 "could not decide",
+ * sendWithAuthRetry treats as the session being over (`onSessionEnded`). Every other
+ * outcome rejects with AuthUnavailableError, shared by every waiting caller, so no caller
+ * ever announces a session end over an outage: the plugin's own 503 "could not decide",
  * and an outcome that is no decision at all (AUTH_UNREACHABLE_CODE) — a network error,
  * the deadline (the server's `/refresh` can legitimately outlast it: a contended
  * session lock plus a slow flytedesk-id `/token` and authorization call), or a status
@@ -113,17 +111,23 @@ export interface RequestOptions {
      *  body decode. Past it the call rejects with a RequestDeadlineError and does nothing
      *  further (no retry, no auth-failure event). */
     deadlineMs?: number;
-    /** Set only by a session layer's own bootstrap/probe calls, which ARE the auth
-     *  recovery (or start it): a 401 that survives the refresh still starts the shared
-     *  recovery, but this call does not wait for it — waiting would mean the recovery
-     *  waiting on itself. */
-    ownsAuthRecovery?: boolean;
     /** Passed straight to `fetch`'s own `keepalive` — lets a request started right
      *  before the page unloads actually complete instead of being cancelled the instant
      *  the page goes away. Only meaningfully used with a small body: the browser caps
      *  the total size of in-flight keepalive requests (~64KB combined). */
     keepalive?: boolean;
+    /** An external abort signal (e.g. a hook's cleanup when a newer request supersedes
+     *  this one) — aborts the in-flight fetch immediately, independent of deadlineMs, and
+     *  the call rejects with the signal's reason (the standard AbortError unless the caller
+     *  passed another). An aborted call is nothing but cancelled: it never retries, starts
+     *  no refresh and announces no session end. The shared token refresh a 401 may have
+     *  started is not cancelled (other callers may be waiting on it). */
+    signal?: AbortSignal;
 }
+/** The absolute URL of `path` on this client's api — for a top-level navigation (the
+ *  sign-in route), which, unlike a fetch, can't be left relative to a dev proxy. A
+ *  same-origin `baseUrl` resolves against `pageOrigin`. */
+export declare function absoluteApiUrl(path: string, pageOrigin: string): string;
 /** The one place a browser app talks to its own BFF api. Handles bearer auth,
  *  transparent access-token refresh on 401, and the { error, code, field? } error
  *  contract every @flytedesk/app-kit/auth-backed api returns. */
@@ -141,8 +145,8 @@ export interface ApiDownloadOptions {
     /** Bounds the whole call exactly like RequestOptions.deadlineMs — first attempt, any
      *  refresh it waits on, the retry and the blob read. */
     deadlineMs?: number;
-    /** An external abort signal (e.g. a component's cleanup) — aborts the in-flight
-     *  fetch immediately, independent of deadlineMs. */
+    /** An external abort signal (e.g. a component's cleanup) — exactly RequestOptions.signal:
+     *  aborts the in-flight fetch immediately, independent of deadlineMs. */
     signal?: AbortSignal;
     skipAuthRetry?: boolean;
 }

package/dist/auth/client/httpClient.js

@@ -47,8 +47,8 @@ export const AUTH_UNREACHABLE_CODE = "auth_unreachable";
  * carrying one of `AUTH_UNAVAILABLE_CODES`) — or the automatic refresh reached no
  * decision at all (`AUTH_UNREACHABLE_CODE`). Transient, and NOT a sign-out: the session
  * (its refresh cookie) is intact and the same request can succeed once the dependency
- * recovers. This client never runs the auth recovery for it; `useAuthSession` keeps the
- * session and retries with backoff (its `"unavailable"` status). A subclass of
+ * recovers. It never announces a session end (`onSessionEnded`); `./authSession.ts` keeps
+ * the session and retries with backoff (its `"unavailable"` status). A subclass of
  * ApiRequestError, so existing `instanceof ApiRequestError` handling still sees it.
  */
 export class AuthUnavailableError extends ApiRequestError {
@@ -87,7 +87,7 @@ async function errorFromResponse(res) {
     }
     return new ApiRequestError(res.status, body);
 }
-/** A request that missed its deadline (see withDeadline). */
+/** A request that missed its deadline (see withCancellation). */
 export class RequestDeadlineError extends Error {
     constructor(what, ms) {
         super(`${what} did not complete within ${ms}ms`);
@@ -111,46 +111,64 @@ export function getAccessToken() {
 export function getBaseUrl() {
     return baseUrl;
 }
-let authRecovery = null;
-/** Registers what runs when a request 401s and the automatic refresh-then-retry dance
- *  (below) also fails to recover it — i.e. the session is genuinely gone, not just a
- *  normal access-token expiry a refresh already fixed silently. A consuming app's own
- *  session layer (e.g. one doing a silent OIDC resume, as media-planner's session.ts
- *  does) is the one owner: it decides what "recovered" means and, failing that,
- *  invalidates its session state. Left entirely unset is fine — decodeWithAuthRetry
- *  then just reports the second 401 as a failure, with no recovery attempt. */
-export function setAuthRecovery(recovery) {
-    authRecovery = recovery;
+const sessionEndedListeners = new Set();
+/**
+ * Subscribes to the ONE signal that a session is over (AK-35): a request answered 401
+ * and the shared `refreshAccessToken()` then resolved `null` — the plugin itself refused
+ * the refresh cookie. That verdict, and only that, is what `./authSession.ts` turns into
+ * the session-expired state and an automatic sign-in. A 401 that follows a SUCCESSFUL
+ * refresh-and-retry is that route's own answer about that request (the session was just
+ * proven live), so it is thrown to the caller and never announced here — treating it as
+ * a session loss would loop: expired -> sign in -> authenticated -> the same 401.
+ * Internal to `@flytedesk/app-kit/auth/client`: an app never subscribes itself.
+ */
+export function onSessionEnded(listener) {
+    sessionEndedListeners.add(listener);
     return () => {
-        if (authRecovery === recovery)
-            authRecovery = null;
+        sessionEndedListeners.delete(listener);
     };
 }
-/** Runs `run` under a deadline: past `ms`, its AbortSignal aborts (so the underlying
- *  fetch, and any body read on it, is cancelled) and the returned promise rejects with
- *  a RequestDeadlineError — the rejection does not depend on whatever `run` awaits
- *  honouring the signal, so this settles no matter what. */
-async function withDeadline(what, ms, run, externalSignal) {
+function announceSessionEnded() {
+    for (const listener of sessionEndedListeners)
+        listener();
+}
+/** Runs `run` under an optional deadline and an optional caller abort signal — the one
+ *  cancellation mechanism every request this client makes goes through. `run` gets an
+ *  AbortSignal that aborts (so the underlying fetch, and any body read on it, is
+ *  cancelled) when the deadline `ms` passes or when `externalSignal` aborts. The
+ *  returned promise then rejects — with a RequestDeadlineError for the deadline, with the
+ *  caller's own abort reason (the standard AbortError unless they passed another) for the
+ *  signal — and that rejection does not depend on whatever `run` awaits honouring the
+ *  signal, so this settles no matter what. A signal that is already aborted rejects
+ *  before `run` starts. */
+async function withCancellation(what, ms, run, externalSignal) {
+    externalSignal?.throwIfAborted();
     const controller = new AbortController();
-    if (externalSignal) {
-        if (externalSignal.aborted)
-            controller.abort(externalSignal.reason);
-        else
-            externalSignal.addEventListener("abort", () => controller.abort(externalSignal.reason), { once: true });
-    }
     let timer;
-    const deadline = new Promise((_, reject) => {
-        timer = setTimeout(() => {
-            const reason = new RequestDeadlineError(what, ms);
-            controller.abort(reason);
-            reject(reason);
-        }, ms);
+    let onExternalAbort;
+    const interrupted = new Promise((_, reject) => {
+        if (externalSignal) {
+            onExternalAbort = () => {
+                controller.abort(externalSignal.reason);
+                reject(externalSignal.reason);
+            };
+            externalSignal.addEventListener("abort", onExternalAbort, { once: true });
+        }
+        if (ms !== undefined) {
+            timer = setTimeout(() => {
+                const reason = new RequestDeadlineError(what, ms);
+                controller.abort(reason);
+                reject(reason);
+            }, ms);
+        }
     });
     try {
-        return await Promise.race([run(controller.signal), deadline]);
+        return await Promise.race([run(controller.signal), interrupted]);
     }
     finally {
         clearTimeout(timer);
+        if (onExternalAbort)
+            externalSignal?.removeEventListener("abort", onExternalAbort);
     }
 }
 /** The AuthUnavailableError (announced to onAuthUnavailable listeners) for a refresh
@@ -164,16 +182,16 @@ function refreshUnreachable(status, cause) {
 /**
  * Runs — or joins, when one is already in flight — THE one `POST {routePrefix}/refresh`,
  * and resolves the new access token (also stored via setAccessToken). Single-flighted and
- * always deadline-bound: every caller that 401s, and useAuthSession's own loads, share
+ * always deadline-bound: every caller that 401s, and `./authSession.ts`'s own loads, share
  * this one refresh — the refresh cookie rotates on every call, so two concurrent
  * refreshes presenting one cookie would race, and a refresh that never answered would
  * stall them all.
  *
  * AK-23 (L-c): only the plugin's verdict signs anyone out. A 401 — the one answer the
  * plugin gives a refresh it refuses — resolves `null` ("no new token"), which
- * sendAndDecode treats as the session being gone. Every other outcome rejects with
- * AuthUnavailableError, shared by every waiting caller, so no caller ever runs the auth
- * recovery (the sign-out path) over an outage: the plugin's own 503 "could not decide",
+ * sendWithAuthRetry treats as the session being over (`onSessionEnded`). Every other
+ * outcome rejects with AuthUnavailableError, shared by every waiting caller, so no caller
+ * ever announces a session end over an outage: the plugin's own 503 "could not decide",
  * and an outcome that is no decision at all (AUTH_UNREACHABLE_CODE) — a network error,
  * the deadline (the server's `/refresh` can legitimately outlast it: a contended
  * session lock plus a slow flytedesk-id `/token` and authorization call), or a status
@@ -182,7 +200,7 @@ function refreshUnreachable(status, cause) {
 export async function refreshAccessToken() {
     if (!refreshPromise) {
         const refreshPath = authRoutePath(AUTH_ROUTE_PREFIX, "refresh");
-        refreshPromise = withDeadline(`POST ${refreshPath}`, DEFAULT_REQUEST_DEADLINE_MS, async (signal) => {
+        refreshPromise = withCancellation(`POST ${refreshPath}`, DEFAULT_REQUEST_DEADLINE_MS, async (signal) => {
             const res = await fetch(`${baseUrl}${refreshPath}`, {
                 method: "POST",
                 credentials: "include",
@@ -216,6 +234,12 @@ export async function refreshAccessToken() {
 function isAbsoluteUrl(value) {
     return /^[a-z][a-z\d+.-]*:\/\//i.test(value);
 }
+/** The absolute URL of `path` on this client's api — for a top-level navigation (the
+ *  sign-in route), which, unlike a fetch, can't be left relative to a dev proxy. A
+ *  same-origin `baseUrl` resolves against `pageOrigin`. */
+export function absoluteApiUrl(path, pageOrigin) {
+    return isAbsoluteUrl(baseUrl) ? `${baseUrl}${path}` : `${pageOrigin}${baseUrl}${path}`;
+}
 function buildUrl(path, query) {
     const url = new URL(baseUrl + path, typeof window !== "undefined" ? window.location.origin : "http://localhost");
     if (query) {
@@ -235,54 +259,40 @@ function buildUrl(path, query) {
     return isAbsoluteUrl(baseUrl) ? url.toString() : url.pathname + url.search;
 }
 /** Shared tail of both apiRequest and apiUpload: fires `doFetch`, transparently
- *  retries once after a refresh on 401 (unless skipped) — and, if that still 401s, once
- *  more after the shared auth recovery (see setAuthRecovery) — and applies the same
+ *  retries once after a refresh on 401 (unless skipped), and applies the same
  *  { error, code, field? } error contract / 204-handling / JSON decode to the result —
- *  all under `deadlineMs` when one is given (see withDeadline). Kept as one place so
+ *  all under the optional `deadlineMs` and the caller's optional abort `signal` (see
+ *  withCancellation). Kept as one place so
  *  the auth-retry dance can't drift between the JSON and multipart transports. */
 async function sendAndDecode(label, doFetch, options) {
-    const { deadlineMs } = options;
-    if (deadlineMs === undefined)
-        return decodeWithAuthRetry(doFetch, options);
-    return withDeadline(label, deadlineMs, (signal) => decodeWithAuthRetry(doFetch, options, signal));
+    const { deadlineMs, signal } = options;
+    return withCancellation(label, deadlineMs, (fetchSignal) => decodeWithAuthRetry(doFetch, options, fetchSignal), signal);
 }
-/** The shared tail of every transport this client offers: fires `doFetch`,
- *  transparently retries once after a refresh on 401 (unless skipped), and once more
- *  after the shared auth recovery if that still 401s (see setAuthRecovery) — then
- *  throws the decoded error on any non-2xx. Returns the successful raw Response so
- *  each transport (JSON body, blob download) can decode it its own way; this is the
- *  ONE place the auth-retry dance lives, so it can't drift between them. */
-async function sendWithAuthRetry(doFetch, { skipAuthRetry, ownsAuthRecovery }, signal) {
-    // Who this request is being sent as — the only identity a recovery may replay it for.
-    const recovery = authRecovery;
-    const sentAs = recovery?.principal() ?? null;
+/** The shared tail of every transport this client offers: fires `doFetch`, and on a
+ *  401 (unless skipped) refreshes once through the shared single-flighted
+ *  `refreshAccessToken` and retries. When that refresh is REFUSED (it resolves `null`),
+ *  the session is over: `onSessionEnded` listeners hear it and the 401 is thrown. Any
+ *  non-2xx left after that is thrown decoded. Returns the successful raw Response so
+ *  each transport (JSON body, blob download) can decode it its own way; this is the ONE
+ *  place the auth-retry dance lives, so it can't drift between them. */
+async function sendWithAuthRetry(doFetch, { skipAuthRetry }, signal) {
     let res = await doFetch(signal);
     if (res.status === 401 && !skipAuthRetry) {
         // Rejects with AuthUnavailableError on an outage (AK-23) — straight out of this
-        // call, past the recovery below: an outage is not a sign-out.
+        // call: an outage is not a sign-out.
         const refreshed = await refreshAccessToken();
-        // The shared refresh is not cancelled by this call's deadline (other callers may
-        // still want it) — but a call that has already missed its deadline must not act on
-        // its outcome: no retry, and no auth-failure event for a caller that gave up.
+        // The shared refresh is not cancelled by this call's deadline or abort (other callers
+        // may still want it) — but a call that has already missed its deadline, or whose
+        // caller aborted it (AK-29), must not act on its outcome: no retry, and no
+        // session-ended announcement for a caller that gave up.
         signal?.throwIfAborted();
-        if (refreshed)
+        if (refreshed === null) {
+            // AK-35: the plugin refused the refresh cookie — the only verdict that ends a
+            // session. See onSessionEnded.
+            announceSessionEnded();
+        }
+        else {
             res = await doFetch(signal);
-        signal?.throwIfAborted();
-        if (res.status === 401) {
-            // Both the original request and the refresh-then-retry (or the refresh call
-            // itself, if it never returned a token) came back 401 — the session is gone,
-            // not just this in-memory access token. See setAuthRecovery.
-            if (recovery && ownsAuthRecovery) {
-                void recovery.recover();
-            }
-            else if (recovery) {
-                await recovery.recover();
-                signal?.throwIfAborted();
-                // Replay only for the same user. A recovery that ended signed out, or signed
-                // in as someone else, leaves this request failed.
-                if (sentAs !== null && recovery.principal() === sentAs)
-                    res = await doFetch(signal);
-            }
             signal?.throwIfAborted();
         }
     }
@@ -300,8 +310,8 @@ async function decodeWithAuthRetry(doFetch, options, signal) {
  *  transparent access-token refresh on 401, and the { error, code, field? } error
  *  contract every @flytedesk/app-kit/auth-backed api returns. */
 export async function apiRequest(path, options = {}) {
-    const { method = "GET", body, query, skipAuthRetry, deadlineMs, ownsAuthRecovery, keepalive } = options;
-    const doFetch = async (signal) => fetch(buildUrl(path, query), {
+    const { method = "GET", body, query, skipAuthRetry, deadlineMs, keepalive, signal } = options;
+    const doFetch = async (fetchSignal) => fetch(buildUrl(path, query), {
         method,
         credentials: "include",
         headers: {
@@ -309,10 +319,10 @@ export async function apiRequest(path, options = {}) {
             ...(accessToken ? { Authorization: `Bearer ${accessToken}` } : {}),
         },
         body: body != null ? JSON.stringify(body) : undefined,
-        signal,
+        signal: fetchSignal,
         ...(keepalive ? { keepalive: true } : {}),
     });
-    return sendAndDecode(`${method} ${path}`, doFetch, { skipAuthRetry, deadlineMs, ownsAuthRecovery });
+    return sendAndDecode(`${method} ${path}`, doFetch, { skipAuthRetry, deadlineMs, signal });
 }
 /** Sibling to apiRequest for multipart/form-data uploads. Same bearer auth, 401 ->
  *  refresh -> retry-once dance, and error contract — but always POSTs `formData` as-is
@@ -377,10 +387,7 @@ export async function apiDownload(path, options = {}) {
         const filename = parseContentDispositionFilename(res.headers.get("content-disposition"));
         return { blob, filename, contentType };
     };
-    const run = async (fetchSignal) => decode(await sendWithAuthRetry(doFetch, { skipAuthRetry }, fetchSignal));
-    if (deadlineMs === undefined)
-        return run(signal);
-    return withDeadline(`GET ${path}`, deadlineMs, run, signal);
+    return withCancellation(`GET ${path}`, deadlineMs, async (fetchSignal) => decode(await sendWithAuthRetry(doFetch, { skipAuthRetry }, fetchSignal)), signal);
 }
 /** Triggers a browser "Save As" for an already-fetched blob (e.g. from apiDownload) —
  *  a transient off-DOM anchor is the standard way to do this without navigating away.

package/dist/auth/client/httpClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"httpClient.js","sourceRoot":"","sources":["../../../src/auth/client/httpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAkB5B;;;8EAG8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,KAAK,CAAU;IACf,MAAM,CAAS;IACf;;qDAEiD;IACjD,IAAI,CAAyC;IAC7C,YAAY,MAAc,EAAE,IAA4C;QACtE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAMxD;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IAEvD,YAAY,MAAc,EAAE,IAAiF;QAC3G,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,SAAS,qBAAqB,CAAC,IAAa;IAC1C,OAAQ,sBAA6C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAGD,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEpE;;oFAEoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,QAAiC;IACjE,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,GAAG,EAAE;QACV,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2B;IACvD,KAAK,MAAM,QAAQ,IAAI,wBAAwB;QAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;+BAE+B;AAC/B,KAAK,UAAU,iBAAiB,CAAC,GAAa;IAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG;SACpB,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAA2C,CAAC;IACxG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,oBAAoB,CAAC,IAAI,oBAAoB,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,6DAA6D;AAC7D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,IAAY,EAAE,EAAU;QAClC,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,cAAc,GAAkC,IAAI,CAAC;AACzD,IAAI,OAAO,GAAG,SAAS,CAAC;AAExB,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;sBACsB;AACtB,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C;;;;;;+EAM+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAsB;IACpD,YAAY,GAAG,QAAQ,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,IAAI,YAAY,KAAK,QAAQ;YAAE,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;;4DAG4D;AAC5D,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,EAAU,EACV,GAAwC,EACxC,cAA4B;IAE5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,cAAc,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;;YAC/D,cAAc,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;4DAC4D;AAC5D,SAAS,kBAAkB,CAAC,MAAc,EAAE,KAAa;IACvD,OAAO,oBAAoB,CACzB,IAAI,oBAAoB,CAAC,MAAM,EAAE;QAC/B,KAAK,EAAE,6CAA6C,KAAK,EAAE;QAC3D,IAAI,EAAE,qBAAqB;KAC5B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAChE,cAAc,GAAG,YAAY,CAC3B,QAAQ,WAAW,EAAE,EACrB,2BAA2B,EAC3B,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,KAAK,YAAY,oBAAoB;oBAAE,MAAM,KAAK,CAAC;gBACvD,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC,CACF;aACE,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,GAAG,YAAY,oBAAoB;gBAAE,MAAM,GAAG,CAAC;YACnD,MAAM,kBAAkB,CACtB,CAAC,EACD,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC,CAC9F,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AA0BD;gFACgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA+B;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,OAAO,GAAG,IAAI,EACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAC5E,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;gBACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oFAAoF;IACpF,oFAAoF;IACpF,4CAA4C;IAC5C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAID;;;;;kFAKkF;AAClF,KAAK,UAAU,aAAa,CAAI,KAAa,EAAE,OAAgB,EAAE,OAAoB;IACnF,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAI,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAI,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;;4EAK4E;AAC5E,KAAK,UAAU,iBAAiB,CAC9B,OAAgB,EAChB,EAAE,aAAa,EAAE,gBAAgB,EAAe,EAChD,MAAoB;IAEpB,sFAAsF;IACtF,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,gFAAgF;QAChF,8DAA8D;QAC9D,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,iFAAiF;QACjF,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,SAAS;YAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,4EAA4E;YAC5E,6EAA6E;YAC7E,6DAA6D;YAC7D,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACjC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,6EAA6E;gBAC7E,kDAAkD;gBAClD,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,MAAM;oBAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,EAAE,cAAc,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,OAAoB,EACpB,MAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED;;iEAEiE;AACjE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,UAA0B,EAAE;IAC5E,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAExG,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAqB,EAAE,CAChE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM;QACN,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;;0CAI0C;AAC1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;oBAIoB;AACpB,SAAS,+BAA+B,CAAC,MAAqB;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,+EAA+E;QAC/E,sDAAsD;QACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAqBD;;;0EAG0E;AAC1E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,UAA8B,EAAE;IAC9E,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAE7D,MAAM,OAAO,GAAG,KAAK,EAAE,WAAyB,EAAqB,EAAE,CACrE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,MAAM,EAAE,WAAW;KACpB,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,KAAK,EAAE,GAAa,EAA8B,EAAE;QACjE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC;QACzG,MAAM,QAAQ,GAAG,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACzF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,KAAK,EAAE,WAAyB,EAA8B,EAAE,CAC1E,MAAM,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAE3E,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,YAAY,CAAC,OAAO,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;+CAE+C;AAC/C,MAAM,UAAU,QAAQ,CAAC,IAAU,EAAE,QAAgB;IACnD,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO;IAC5C,MAAM,UAAU,GAAG,GAAkC,CAAC;IACtD,MAAM,GAAG,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC;QAClB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}
+{"version":3,"file":"httpClient.js","sourceRoot":"","sources":["../../../src/auth/client/httpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAkB5B;;;8EAG8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,KAAK,CAAU;IACf,MAAM,CAAS;IACf;;qDAEiD;IACjD,IAAI,CAAyC;IAC7C,YAAY,MAAc,EAAE,IAA4C;QACtE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAMxD;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IAEvD,YAAY,MAAc,EAAE,IAAiF;QAC3G,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,SAAS,qBAAqB,CAAC,IAAa;IAC1C,OAAQ,sBAA6C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAGD,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEpE;;oFAEoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,QAAiC;IACjE,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,GAAG,EAAE;QACV,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2B;IACvD,KAAK,MAAM,QAAQ,IAAI,wBAAwB;QAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;+BAE+B;AAC/B,KAAK,UAAU,iBAAiB,CAAC,GAAa;IAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG;SACpB,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAA2C,CAAC;IACxG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,oBAAoB,CAAC,IAAI,oBAAoB,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,iEAAiE;AACjE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,IAAY,EAAE,EAAU;QAClC,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,cAAc,GAAkC,IAAI,CAAC;AACzD,IAAI,OAAO,GAAG,SAAS,CAAC;AAExB,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;sBACsB;AACtB,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAwB,CAAC;AAE9D;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,QAA8B;IAC3D,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,GAAG,EAAE;QACV,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB;IAC3B,KAAK,MAAM,QAAQ,IAAI,qBAAqB;QAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;2BAQ2B;AAC3B,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EACZ,EAAsB,EACtB,GAAwC,EACxC,cAA4B;IAE5B,cAAc,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,IAAI,eAAyC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,cAAc,EAAE,CAAC;YACnB,eAAe,GAAG,GAAG,EAAE;gBACrB,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC,CAAC;YACF,cAAc,CAAC,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAClD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACzB,MAAM,CAAC,MAAM,CAAC,CAAC;YACjB,CAAC,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,eAAe;YAAE,cAAc,EAAE,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED;4DAC4D;AAC5D,SAAS,kBAAkB,CAAC,MAAc,EAAE,KAAa;IACvD,OAAO,oBAAoB,CACzB,IAAI,oBAAoB,CAAC,MAAM,EAAE;QAC/B,KAAK,EAAE,6CAA6C,KAAK,EAAE;QAC3D,IAAI,EAAE,qBAAqB;KAC5B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAChE,cAAc,GAAG,gBAAgB,CAC/B,QAAQ,WAAW,EAAE,EACrB,2BAA2B,EAC3B,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,KAAK,YAAY,oBAAoB;oBAAE,MAAM,KAAK,CAAC;gBACvD,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC,CACF;aACE,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,GAAG,YAAY,oBAAoB;gBAAE,MAAM,GAAG,CAAC;YACnD,MAAM,kBAAkB,CACtB,CAAC,EACD,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC,CAC9F,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AA4BD;gFACgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;2DAE2D;AAC3D,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAkB;IAC7D,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA+B;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,OAAO,GAAG,IAAI,EACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAC5E,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;gBACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oFAAoF;IACpF,oFAAoF;IACpF,4CAA4C;IAC5C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAID;;;;;kFAKkF;AAClF,KAAK,UAAU,aAAa,CAAI,KAAa,EAAE,OAAgB,EAAE,OAAoB;IACnF,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACvC,OAAO,gBAAgB,CACrB,KAAK,EACL,UAAU,EACV,CAAC,WAAW,EAAE,EAAE,CAAC,mBAAmB,CAAI,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EACtE,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;wEAMwE;AACxE,KAAK,UAAU,iBAAiB,CAC9B,OAAgB,EAChB,EAAE,aAAa,EAAe,EAC9B,MAAoB;IAEpB,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,gFAAgF;QAChF,qCAAqC;QACrC,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,sFAAsF;QACtF,iFAAiF;QACjF,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,8EAA8E;YAC9E,+BAA+B;YAC/B,oBAAoB,EAAE,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,EAAE,cAAc,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,OAAoB,EACpB,MAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED;;iEAEiE;AACjE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,UAA0B,EAAE;IAC5E,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE9F,MAAM,OAAO,GAAG,KAAK,EAAE,WAAyB,EAAqB,EAAE,CACrE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM;QACN,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM,EAAE,WAAW;QACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED;;;;0CAI0C;AAC1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;oBAIoB;AACpB,SAAS,+BAA+B,CAAC,MAAqB;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,+EAA+E;QAC/E,sDAAsD;QACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAqBD;;;0EAG0E;AAC1E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,UAA8B,EAAE;IAC9E,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAE7D,MAAM,OAAO,GAAG,KAAK,EAAE,WAAyB,EAAqB,EAAE,CACrE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,MAAM,EAAE,WAAW;KACpB,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,KAAK,EAAE,GAAa,EAA8B,EAAE;QACjE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC;QACzG,MAAM,QAAQ,GAAG,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACzF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACzC,CAAC,CAAC;IAEF,OAAO,gBAAgB,CACrB,OAAO,IAAI,EAAE,EACb,UAAU,EACV,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,WAAW,CAAC,CAAC,EAC/F,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;+CAE+C;AAC/C,MAAM,UAAU,QAAQ,CAAC,IAAU,EAAE,QAAgB;IACnD,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO;IAC5C,MAAM,UAAU,GAAG,GAAkC,CAAC;IACtD,MAAM,GAAG,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC;QAClB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/auth/client/index.d.ts

@@ -1,12 +1,19 @@
 /**
  * Browser-safe client for `@flytedesk/app-kit/auth` — a separate subpath export (see
  * package.json's "exports") so this never drags a single Node/Fastify import into a
- * browser bundle. See httpClient.ts and useAuthSession.ts's own doc comments for what
- * was extracted from where and why (AK-16).
+ * browser bundle.
+ *
+ * Two things live here, and an app uses both:
+ *  - the flytedesk ID session lifecycle (AK-35): `SessionBoundary`, `useAuthSession` and
+ *    `authSession` — sign-in, session loss, checks, sign-out and cross-tab, decided in
+ *    ONE place (`./authSession.ts`). An app never builds any of it itself; see the
+ *    README's "Building a flytedesk ID app";
+ *  - the api client every request goes through (`apiRequest`, `apiUpload`,
+ *    `apiDownload`), which carries the session's access token and refreshes it.
  */
-export { ApiRequestError, AuthUnavailableError, AUTH_UNREACHABLE_CODE, type AuthUnavailableErrorCode, RequestDeadlineError, onAuthUnavailable, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, apiDownload, saveBlob, type AuthRecovery, type RequestOptions, type ApiDownloadOptions, type ApiDownloadResult, } from "./httpClient.js";
-export { useAuthSession, unavailableRetryDelayMs, UNAVAILABLE_RETRY_BASE_MS, UNAVAILABLE_RETRY_MAX_MS, type AuthStatus, type AuthSessionState, type LoadingSessionState, type AuthenticatedSessionState, type UnauthenticatedSessionState, type UnavailableSessionState, type ErrorSessionState, } from "./useAuthSession.js";
-export { attemptSilentResume, type SilentResumeResult, type AttemptSilentResumeOptions, } from "./silentAuth.js";
-export { consumeSignInError } from "./signInError.js";
-export type { AppSwitcherEntry, AuthedUserDto, IdpRole, ApiErrorBody, AuthUnavailableCode, SilentAuthDetailCode, SilentAuthMessage, } from "../shared-types.js";
-export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, AUTH_UNAVAILABLE_CODES, authRoutePath, SILENT_AUTH_DETAIL_CODES, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, type AuthRouteSegment, type SignInErrorCode, } from "../shared-types.js";
+export { ApiRequestError, AuthUnavailableError, AUTH_UNREACHABLE_CODE, type AuthUnavailableErrorCode, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, getBaseUrl, apiRequest, apiUpload, apiDownload, saveBlob, type RequestOptions, type ApiDownloadOptions, type ApiDownloadResult, } from "./httpClient.js";
+export { type AuthSessionState, type AuthenticatedState, type CheckingState, type ErrorState, type SigningInState, type SigningOutState, type UnavailableState, } from "./authSession.js";
+export { authSession } from "./browserEnvironment.js";
+export { SessionBoundary, useAuthSession, type AuthSession, type AuthSessionActions, type SessionBoundaryProps, type SessionScreenKind, type SessionScreenState, type UsableSession, } from "./useAuthSession.js";
+export type { AppSwitcherEntry, AuthedUserDto, IdpRole, ApiErrorBody, AuthUnavailableCode, } from "../shared-types.js";
+export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, AUTH_UNAVAILABLE_CODES, authRoutePath, type AuthRouteSegment, } from "../shared-types.js";

package/dist/auth/client/index.js

@@ -1,12 +1,18 @@
 /**
  * Browser-safe client for `@flytedesk/app-kit/auth` — a separate subpath export (see
  * package.json's "exports") so this never drags a single Node/Fastify import into a
- * browser bundle. See httpClient.ts and useAuthSession.ts's own doc comments for what
- * was extracted from where and why (AK-16).
+ * browser bundle.
+ *
+ * Two things live here, and an app uses both:
+ *  - the flytedesk ID session lifecycle (AK-35): `SessionBoundary`, `useAuthSession` and
+ *    `authSession` — sign-in, session loss, checks, sign-out and cross-tab, decided in
+ *    ONE place (`./authSession.ts`). An app never builds any of it itself; see the
+ *    README's "Building a flytedesk ID app";
+ *  - the api client every request goes through (`apiRequest`, `apiUpload`,
+ *    `apiDownload`), which carries the session's access token and refreshes it.
  */
-export { ApiRequestError, AuthUnavailableError, AUTH_UNREACHABLE_CODE, RequestDeadlineError, onAuthUnavailable, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, apiDownload, saveBlob, } from "./httpClient.js";
-export { useAuthSession, unavailableRetryDelayMs, UNAVAILABLE_RETRY_BASE_MS, UNAVAILABLE_RETRY_MAX_MS, } from "./useAuthSession.js";
-export { attemptSilentResume, } from "./silentAuth.js";
-export { consumeSignInError } from "./signInError.js";
-export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, AUTH_UNAVAILABLE_CODES, authRoutePath, SILENT_AUTH_DETAIL_CODES, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, } from "../shared-types.js";
+export { ApiRequestError, AuthUnavailableError, AUTH_UNREACHABLE_CODE, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, getBaseUrl, apiRequest, apiUpload, apiDownload, saveBlob, } from "./httpClient.js";
+export { authSession } from "./browserEnvironment.js";
+export { SessionBoundary, useAuthSession, } from "./useAuthSession.js";
+export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, AUTH_UNAVAILABLE_CODES, authRoutePath, } from "../shared-types.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EAErB,oBAAoB,EACpB,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,GAKT,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,GAQzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAWtD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EAErB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,UAAU,EACV,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,GAIT,MAAM,iBAAiB,CAAC;AAYzB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EACL,eAAe,EACf,cAAc,GAOf,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,GAEd,MAAM,oBAAoB,CAAC"}

package/dist/auth/client/testing.d.ts

@@ -0,0 +1,6 @@
+/** Makes every following `apiRequest`/`apiUpload`/`apiDownload` send `token` as its
+ *  Bearer — as if the session had just refreshed. `null` clears it. */
+export declare function setTestAccessToken(token: string | null): void;
+/** Stops the tab's session lifecycle, forgets its state and clears the access token, so
+ *  the next test starts from a fresh boot. */
+export declare function resetAuthSessionForTests(): void;